actaully in that case you disable protocol from ALL the interfaces, not
just one....I tried it
tom
d_greenjr wrote:
>I was told the following but have not tried it:
>" On NT you just disable all bindings for a network card. I haven´t tried
>this
>with snort but it works just fine with other IDS´s."
>>Let me know if it works.
>>----- Original Message -----
>From: "Tom Culpepper" <tculpepp at ...8819...>
>To: <snort-users at lists.sourceforge.net>
>Sent: Tuesday, April 08, 2003 8:05 PM
>Subject: Re: [Snort-users] stealth interface
>>>>>>Is something like this possible on a windows system?
>>>>>>Eric Baur wrote:
>>>>>>>>> Some of the other replies seem like too much work... and are
>>>harder to maintain (or someone else to figure out if they need to
>>>figure out what you did).
>>> You should be able to change the ifcfg-eth1 file (or whatever
>>>number you want to be ip-less) to be:
>>>>>>DEVICE=eth1
>>>ONBOOT=yes
>>>BOOTPROTO=none
>>>>>> That seems to be working in my installation (also RH8.0) without
>>>any issues. (Now, my next mystery is seeing if I can find a way to
>>>refer to the devices as "lan", "wan" and "dmz" instead of "eth1",
>>>"eth2" and "eth3".)
>>>>>>Eric
>>>>>>d_greenjr wrote:
>>>>>>>>>>>>> Can someone tell me or give me the URL on how to create an
>>>> interface with no ipaddr (stealth), on a linux [RH8] system? (Not
>>>> the receive only cable-I saw that in the snort FAQs) I have
>>>> searched the Internet and the snort archives but have not found a
>>>> message/page that describes what to do-only the end results.
>>>>>>>>>Thanks
>>>>>>>>-------------------------------------------------------
>>This SF.net email is sponsored by: ValueWeb:
>>Dedicated Hosting for just $79/mo with 500 GB of bandwidth!
>>No other company gives more support or power for your dedicated server
>>http://click.atdmt.com/AFF/go/sdnxxaff00300020aff/direct/01/>>_______________________________________________
>>Snort-users mailing list
>>Snort-users at lists.sourceforge.net>>Go to this URL to change user options or unsubscribe:
>>https://lists.sourceforge.net/lists/listinfo/snort-users>>Snort-users list archive:
>>http://www.geocrawler.com/redir-sf.php3?list=snort-users>>>>>>>>>-------------------------------------------------------
>This SF.net email is sponsored by: ValueWeb:
>Dedicated Hosting for just $79/mo with 500 GB of bandwidth!
>No other company gives more support or power for your dedicated server
>http://click.atdmt.com/AFF/go/sdnxxaff00300020aff/direct/01/>_______________________________________________
>Snort-users mailing list
>Snort-users at lists.sourceforge.net>Go to this URL to change user options or unsubscribe:
>https://lists.sourceforge.net/lists/listinfo/snort-users>Snort-users list archive:
>http://www.geocrawler.com/redir-sf.php3?list=snort-users>>>